Extracted

• • Target

    de8324c81f580d5f1f3f313224f9cee2_JaffaCakes118

  • Size

    11.4MB

  • MD5

    de8324c81f580d5f1f3f313224f9cee2

  • SHA1

    e0eeaa9e3000f88f3c37c15949bc90cd45a80fab

  • SHA256

    ee9b872015d916a29d3cb56629f02477d60ad22e62013ded3914fd72ea97f966

  • SHA512

    d5ebd3502d271830240fceac7aacf5b2235383584c86917f825191cc351c81b4517df589d98bcc066cbeb8ecdc2108bf57974d0324f107d04e0e19493de1523c

  • SSDEEP

    24576:Wm1111111111111111111111111111111111111111111111111111111111111V:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2